Permissions
Approval before writes and commands.
Permission before actions
Writes and terminal commands wait on approval. The product does not run an unsupervised tool loop.
Approval policy
Settings can require a decision before risky work. Read-only policy blocks writes. Exact labels in Settings are the source of truth on this install.